2012-20886. Privacy Act; Implementation

AGENCY:

Department of Health and Human Services.

ACTION:

Direct Final rule.

SUMMARY:

The Department of Health and Human Services (HHS or Department), through the National Institutes of Health (NIH), is implementing a new system of records, 09-25-0223, “NIH Records Related to Research Misconduct Proceedings, HHS/NIH.” HHS is exempting this system of records from certain provisions of the Privacy Act to protect the integrity of NIH research misconduct proceedings and to protect the identity of confidential sources in such proceedings. HHS is issuing a direct final rule for this action because the agency expects that there will be no significant adverse comment on this rule. Elsewhere in this issue of the Federal Register, HHS is publishing a companion proposed rule under the agency's usual procedure for notice-and-comment rulemaking to provide a procedural framework to finalize the rule in the event the agency receives any significant comments and withdraws this direct final rule. The companion proposed rule and this direct final rule are substantively identical.

DATES:

This rule is effective January 10, 2013. Submit either electronic or written comments by November 13, 2012. If HHS/NIH receives no significant adverse comments within the specified comment period, the agency will publish a document confirming the effective date of the final rule in the Federal Register within 30 days after the comment period on this direct final rule ends. If timely significant adverse comments are received, the agency will publish a document in the Federal Register withdrawing this direct final rule before its effective date.

ADDRESSES:

You may submit comments, identified by [Docket No(s).], by any of the following methods:

Electronic Submissions

Submit electronic comments in the following way:

• Federal eRulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments.

Written Submissions

Submit written submissions in the following ways:

• Fax: [phone].
• Mail: Jerry Moore, NIH Regulations Officer, Office of Management Assessment, National Institutes of Health, 6011 Executive Boulevard, Suite 601, MSC 7669, Rockville, MD 20852-7669.

To ensure more timely processing of comments, HHS/NIH is no longer accepting comments submitted to the agency by email. HHS/NIH encourages you to continue to submit electronic comments by using the Federal eRulemaking Portal, as described previously, in the ADDRESSES portion of this document under Electronic Submissions.

Instructions: All submissions received must include the agency name and Docket No. for this rulemaking. All comments received may be posted without change to http://www.regulations.gov,, including any personal information provided.

Docket: For access to the docket to read background documents or comments received, go to http://www.regulations.gov and follow the instructions provided for conducting a search, using the docket number(s) found in brackets in the heading of this document.

FOR FURTHER INFORMATION CONTACT:

Jerry Moore, NIH Regulations Officer, Office of Management Assessment, National Institutes of Health, 6011 Executive Boulevard, Suite 601, MSC 7669, Rockville, MD 20852-7669, telephone [phone], fax [phone], email [e-mail].

SUPPLEMENTARY INFORMATION:

NIH is implementing a new system of records called, “NIH Records Related to Research Misconduct Proceedings” (09-25-0223). This system of records is part of NIH's implementation of its responsibilities under the Public Health Service (PHS) Policies on Research Misconduct, 42 CFR part 93. The system notice applies to alleged or actual research misconduct involving research: (1) Carried out in NIH facilities by any person; (2) funded by the NIH Intramural Research Program (IRP) in any location; or (3) undertaken by an NIH employee or trainee as part of his or her official NIH duties or NIH training activities, regardless of location. A person who, at the time of the alleged or actual research misconduct, was employed by, was an agent of, or was affiliated by contract, agreement, or other arrangement with NIH, is covered by the system if, for example, he or she is involved in: (1) NIH- or PHS-supported biomedical or behavioral research; (2) NIH- or PHS-supported biomedical or behavioral research training programs; (3) NIH- or PHS-supported activities that are related to biomedical or behavioral research or research training, such as the operation of tissue and data banks and the dissemination of research information; (4) plagiarism of research records produced in the course of NIH- or PHS-supported research, research training or activities related to that research or research training; or (5) an application or proposal for NIH or PHS support for biomedical or behavioral research, research training or activities related to that research or research training, such as the operation of tissue and data banks and the dissemination of research information (regardless of whether it is approved or funded).

The term “research misconduct” is defined at 42 CFR 93.103 to mean “fabrication, falsification, or plagiarism in proposing, performing, or reviewing research, or in reporting research results.” The general policy of the PHS Policies on Research Misconduct is that “Research misconduct involving PHS support is contrary to the interests of the PHS and the Federal government and to the health and safety of the public, to the integrity of research, and to the conservation of public funds.” 42 CFR 93.100(a). The PHS Policies on Research Misconduct provide for a number of HHS administrative actions that can be taken in response to a research misconduct proceeding, such as an adverse personnel action against a federal employee, the suspension of a contract, or debarment. 42 CFR 93.407. In addition, pursuant to 42 CFR 93.318 and 93.401, NIH shall at any time during a research misconduct proceeding notify the HHS Office of Research Integrity (ORI) immediately to ensure that NIH's Office of Management Assessment, HHS' Office of Inspector General, the Department of Justice, or other appropriate law enforcement agencies are notified and consulted, if there is a reasonable indication of possible violations of civil or criminal law that may involve such offices.

NIH's system of records is modeled after the system of records maintained by ORI, entitled “HHS Records Related to Research Misconduct Proceedings, HHS/OS/ORI” System No. 09-37-0021 (59 FR 36717, July 19, 1994; revised most recently at 74 FR 44847, Aug. 31, 2009).

NIH's records related to research misconduct proceedings are located in the Office of Intramural Research in NIH's Office of the Director. NIH is updating its organization and operation of these records, to be exempt from Privacy Act requirements, as provided in this direct final rule and in a new “System of Records Notice” which NIH is publishing in the Federal Register for public comment contemporaneously with or soon after publication of this direct final rule.

Under the Privacy Act (5 U.S.C. 552a), individuals have a right of access to information pertaining to them which is contained in a system of records. At the same time, the Act permits certain types of systems to be exempt from some of the Privacy Act requirements, including the access requirement. For example, section 552a(k)(2) allows agency heads to exempt from certain Privacy Act provisions a system of records containing investigatory material compiled for law enforcement purposes. This exemption's effect on the access requirement is qualified in that if the maintenance of the material results in the denial of any right, privilege, or benefit that the individual would be otherwise entitled to by Federal law, the individual must be granted access to the material unless the access would reveal the identity of a source who furnished information to the Government under an express promise of confidentiality. In addition, section 552a(k)(5) permits an agency to exempt investigatory material from certain Privacy Act provisions where such material is compiled solely for the purpose of determining suitability, eligibility, or qualifications for Federal civilian employment, military service, Federal contracts, or access to classified information, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence.

As stated above, NIH may take administrative action in response to a research misconduct proceeding and, where a civil or criminal fraud may have taken place, NIH may refer the matter to the appropriate investigative body. As such, NIH's records related to research misconduct proceedings are compiled for law enforcement purposes, and the subsection (k)(2) exemption is applicable to this system of record. Moreover, where records related to research misconduct proceedings are compiled solely for the purpose of making determinations as to the suitability for appointment as special government employees or eligibility for Federal contracts from PHS agencies, the subsection (k)(5) exemption is applicable.

Exempting the system from Privacy Act provisions pertaining to providing an accounting of disclosures, access and amendment, notification, and procedures and rules is necessary to maintain the integrity of the research misconduct proceedings and to ensure that the NIH's efforts to obtain accurate and objective information will not be hindered.

Accordingly, HHS/NIH is exempting this system under subsections (k)(2) and (k)(5) of the Privacy Act from the accounting, access, and amendment, notification and procedures and rules provisions of the Privacy Act (paragraphs (c)(3), (d)(1)-(4), (e)(4)(G) and (H), and (f)) for the reasons stated below. However, consideration will be given to requests for notification, access, and amendment that are addressed to the System Manager. The specific rationale for exempting the system from each of these provisions is as follows:

• Subsection (c)(3). An exemption from the requirement to provide an accounting of disclosures is needed during the pendency of a research misconduct proceeding. Release of an accounting of disclosures to an individual who is the subject of a pending research misconduct assessment, inquiry or investigation could prematurely reveal the nature and scope of the assessment, inquiry or investigation and could result in the altering or destruction of evidence, improper influencing of witnesses, and other evasive actions that could impede or compromise the proceeding.
• Subsection (d)(1). An exemption from the access requirement is needed both during and after a research misconduct proceeding, to avoid revealing the identity of any source who was expressly promised confidentiality. Only material that would reveal a confidential source will be exempt from access. Protecting the identity of a source is necessary when the source is unwilling to come forward and report possible research misconduct because of fear of retaliation (e.g., from an employee or co-worker).
• Subsections (d)(2) through (d)(4). An exemption from the amendment provisions is necessary while one or more related research misconduct proceedings are pending. Allowing amendment of investigative records in a pending proceeding could interfere with that proceeding; even after that proceeding is concluded, an amendment could interfere with other pending or prospective research misconduct proceedings, or could significantly delay inquiries or investigations in an attempt to resolve questions of accuracy, relevance, timeliness, and completeness.
• Subsections (e)(4)(G) and (H). An exemption from the notification provisions is necessary during the pendency of a research misconduct proceeding, because notifying an individual who is the subject of an assessment, inquiry, or investigation of the fact of such proceedings could prematurely reveal the nature and scope of the proceedings in a manner that could result in the altering or destruction of evidence, improper influencing of witnesses, and other evasive actions that could impede or compromise the proceeding.
• Subsection (f). An exemption from this requirement to establish procedures for notification, access to records, amendment of records, or appeals of denials of access to records, is necessary because the procedures would serve no purpose in light of the other exemptions, to the extent that those exemptions apply.

As stated above, NIH's system of records is modeled after the system of records maintained by HHS' Office of Research Integrity (ORI). ORI has exempted these records under subsections (k)(2) and (k)(5) of the Privacy Act from the notification, accounting, access, and amendment provisions of the Privacy Act, to ensure that these investigative files will not be disclosed inappropriately [59 FR 36717 (July 19, 1994)]. Likewise, NIH believes that exempting the new system, “NIH Records Related to Research Misconduct Proceedings, HHS/NIH,” from the Privacy Act provisions is essential to ensure that material in NIH's files related to research misconduct proceedings is not disclosed inappropriately. Except for information that would reveal the identity of a source who was expressly promised confidentiality, the access exemption will not prohibit HHS/NIH from granting respondents' access requests consistent with the PHS Policies on Research Misconduct (42 CFR Part 93), including in those cases in which a finding of research misconduct has become final and an administrative action has been imposed.

Analysis of Impacts

HHS/NIH has examined the impacts of the final rule under Executive Order 12866 and the Regulatory Flexibility Act (5 U.S.C. 601-612), and the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4). Executive Order 12866 directs agencies to assess all costs and benefits of available regulatory alternatives and, when regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety, and other advantages; distributive impacts; and equity). The agency believes that this final rule is not a significant regulatory action under the Executive Order.

The Regulatory Flexibility Act requires agencies to analyze regulatory options that would minimize any significant impact of a rule on small entities. Because the final rule imposes no duties or obligations on small entities, the agency certifies that the final rule will not have a significant economic impact on a substantial number of small entities.

Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires that agencies prepare a written statement, which includes an assessment of anticipated costs and benefits, before proposing “any rule that includes any Federal mandate that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more (adjusted annually for inflation) in any one year.” The current threshold after adjustment for inflation is $136 million, using the most current (2010) Implicit Price Deflator for the Gross Domestic Product. NIH does not expect this final rule to result in any 1-year expenditure that would meet or exceed this amount.

List of Subjects in 45 CFR Part 5b

• Privacy

For the reasons set out in the preamble, the Department's Privacy Act Regulations, Part 5b of 45 CFR Subtitle A, are amended as follows:

PART 5b—PRIVACY ACT REGULATIONS

1. The authority citation for Part 5b continues to read as follows:

Authority: 5 U.S.C. 301, 5 U.S.C. 552a

2. In § 5b.11, add paragraph (b)(2)(vii)(D) to read as follows:

§ 5b.11

Exempt systems.

* * * * *

(b) * * *

(2) * * *

(vii) * * *

(D) NIH Records Related to Research Misconduct Proceedings, HHS/NIH, 09-25-0223.

* * * * *

Dated: July 20, 2012.

Kathleen Sebelius,

Secretary, Department of Health and Human Services.